Privacy policy

The controller responsible for processing on this website (Art. 4(7) GDPR) is:

Tom Hoppen
Südwall 65, 41179 Mönchengladbach
Email: tom.hoppen@icloud.com

No data protection officer has been appointed because the conditions of § 38 BDSG are currently not met. Please send privacy questions to the email address above.

• We process only the data needed for valuation, matching and handover (data minimisation, Art. 5(1)(c) GDPR).
• We do not sell data and show no advertising.
• We use no analytics, advertising or tracking cookies and no third-party trackers.
• Fonts are delivered from our own server; your browser does not connect to Google or other third parties for them.
• Listings are anonymous. A business's name, location and documents are disclosed to one successor only, after mutual interest and an accepted confidentiality agreement.

When you visit the website, our hosting provider processes technically necessary data: IP address, date and time, requested address, amount of data transferred, browser and operating system details and the referring page. These data are needed to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

Website hosting: Vercel Inc. (USA), region Frankfurt am Main (fra1). Database and file storage: Supabase Inc. (USA), project region Frankfurt am Main (eu-central-1). Data processing agreements under Art. 28 GDPR are in place with both providers, or will be concluded before launch. For transfers to the USA see “Transfers to third countries”.

To protect against abusive login attempts, mass sign-ups and spam we count attempts per IP address or per account. For this we keep, for at most 15 minutes, a check value created with a secret key (keyed hash) of the IP address or e-mail address plus a counter, partly in memory and partly in our database; the IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR (protecting our users' accounts).

We store only information on your device that is strictly necessary for the functions you explicitly request (§ 25(2) no. 2 TDDDG). No consent is required for this, which is why we show no cookie banner. We use no analytics or advertising cookies.

Data in localStorage does not leave your device unless you save it to your account yourself.

For an account we process name, email address, password (only as a bcrypt hash, never in plain text), role (owner, successor, partner) and preferred language. If you turn on two-factor login, we also store the secret key of your authenticator app (encrypted) and your recovery codes (only as a hash). The legal basis is Art. 6(1)(b) GDPR (user agreement). We keep the data until you delete your account.

For the valuation we process information about your business: name, industry, city, state, founding year, number of employees, revenue, owner earnings, asset value, customer concentration, owner dependence, timeline and priorities. Without an account this stays in your browser. If you save the report to your account, we process it on our servers. The legal basis is Art. 6(1)(b) GDPR.

If you publish a listing, all visitors see only: industry, state and classes for headcount, years in business, revenue, owner earnings and value. A successor sees exact figures only once you both want to meet. The business name, city and your name are not shown. We review every listing before it goes live.

For matching we process information on occupation, experience, qualifications, desired industries and regions, price range, timing, commitments (e.g. keeping the team) as well as equity and willingness to finance. The legal basis is Art. 6(1)(b) GDPR.

From this information we automatically calculate a match score (profiling within the meaning of Art. 4(4) GDPR). The weights are published on our methodology page. The score is a suggestion; it has no legal effect and does not similarly significantly affect you. Only people decide whether a conversation happens. Art. 22 GDPR therefore does not apply.

Owners of a matched business see your profile summary (headline, years of experience, the range of your own funds and the score components), but not your name or email address. They see your name only once you have both expressed interest.

When you request contact, the owner also sees your short introduction (who you are, why this business, plans for the team, financing). If an owner declines, you see the reason chosen. We store this with the match and delete it with your account. The legal basis is Art. 6(1)(b) GDPR.

Owners can submit their latest financial statement or management accounts and proof of ownership; successors a financing confirmation or proof of own funds and proof of qualification. The financial statement is required to publish a listing. Only Erbelo sees the document; we check that it matches your details and delete it immediately after the decision. We keep only the type of check, the result, the date and, if applicable, a short reason for rejection; other users see only the result as a badge (“Figures verified” etc.). Please black out anything not needed for the check (e.g. account numbers, details about third parties). The legal basis is Art. 6(1)(b) GDPR; we keep the result until you delete your account.

In the deal room we process your messages, uploaded documents (file name, size, content), the time the confidentiality agreement was accepted, step progress and the figures in the financing calculator. The only recipient is the other party to that deal; the successor can see and download documents only after accepting the confidentiality agreement. The legal basis is Art. 6(1)(b) GDPR. We log every download of a document (document, side of the deal, time) and show it to both sides in the deal room; the log is deleted with the deal. Please upload only documents needed for the review and redact private details of third parties (e.g. employees' home addresses).

If you write to us via the contact form or by email, we process name, email address, topic and message, and your phone number if you ask for a callback, to answer your request. The legal basis is Art. 6(1)(b) GDPR (requests about our service) or (f) (other requests). We delete the message once the request is settled and no retention duty applies, at the latest after 12 months.

If you apply as a partner, we store organisation, type, region, contact person, email, optionally phone, website and message to handle your request and set up the partnership (Art. 6(1)(b) GDPR). We delete rejected requests after 12 months. If you enter a partner code when signing up (the field is optional and pre-filled by a partner's link; nothing is stored in your browser for this), we note on your account which partner you came through; the partner sees only the number of sign-ups, not your data (Art. 6(1)(f) GDPR, legitimate interest in running the partner programme).

We count how often key steps are reached (e.g. “valuation completed”, “sign-up”) to improve the service. We store only the event name, time and non-sensitive attributes such as market or industry, without IP address, user ID or cookie. No link to a person is created. No external analytics services are used.

Owners can click to get a suggestion for the anonymous description in their listing from a language model by Anthropic PBC, USA. Nothing is sent without that click. Only choices from the questionnaire are sent: industry, state, years in business as a range, team size as a range, how long the owner trains the successor, and the selected handover wishes. Never sent: business name, city, revenue, earnings, names, contact details, messages or documents. Under its commercial terms the provider does not use this data for training. The suggestion is used only if the owner accepts it, and we review every listing before it is published. Valuation, handover readiness and matching are never calculated with AI. The legal basis is Art. 6(1)(b) GDPR (a feature the user requests). For the transfer to the USA, see the section on third countries. Second, logged-in owners can upload a BWA, annual statement or profit & loss statement (PDF or image, max. 4 MB) to get suggested figures for the valuation questionnaire. For this we first ask for your explicit consent (Art. 6(1)(a) GDPR; you can withdraw it at any time for the future by no longer using the feature). The file is sent to the provider once and is not stored by Erbelo; only the figures come back, which you check and apply yourself. If the document contains details about third parties (e.g. salaries), please redact them first.

• The other party to a match or deal, to the extent described above.
• Processors for hosting, database, file storage and optionally AI (see above), bound by instructions under Art. 28 GDPR.
• Our administrators, only as needed for operation, listing review and troubleshooting.
• Authorities only where we are legally obliged.

Some of our service providers are based in the USA. Where possible, data is stored in the EU (Frankfurt am Main). Where data is transferred to the USA or can be accessed from there, this is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) if the provider is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

We keep personal data as long as your account exists. If you delete your account, we immediately remove the account, business or profile, matches, deals, messages and uploaded files. Usage statistics contain no personal data. Data disappears from the database provider's backups when the respective backup cycle ends. Statutory retention duties (e.g. for invoices under § 147 AO, § 257 HGB) remain unaffected.

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR) – yourself in the dashboard under “Delete my account”
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR) – yourself in the dashboard under “Download my data” (JSON file)

Right to object (Art. 21 GDPR): where we process data based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) (https://www.ldi.nrw.de).

You are not legally or contractually obliged to provide data. Without an email address and password, however, we cannot create an account, and without business or profile information we cannot offer a valuation or matching.

We protect your data with technical and organisational measures under Art. 32 GDPR, including: encrypted connections throughout (TLS, HSTS), passwords only as bcrypt hashes, signed HttpOnly session cookies, strict access checks on every deal and every download, login rate limits, checks on uploaded files, a restrictive content security policy and no third-party scripts. Details on our “Privacy & security” page.

We update this privacy policy when our service or the law changes. The version published on this page applies. The German version is binding.